Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe
-
Size
200KB
-
MD5
94bd7e6fde6f46a398f0daa563f7d010
-
SHA1
1281107cf29978dd9ed18b6ca52c65a08419a2f2
-
SHA256
00aeeb078bf345b552d4562116fc756edfbb32071a1a8219ec46d21b1b727fd6
-
SHA512
1f5acf27c6723c1612ce285320757e91b6edb6ef321d1ebbf12646e471c033438a67b19192a9aad8a5fd54dcc9237167ec389bbbc74577cce595be4130c7127e
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUt6id:n3C9BRIG0asYFm71m8+GdkB9k
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/1836-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9llrfrl.exevjjjj.exerrrrlll.exehtbtnn.exefxfxllf.exebtbttt.exepppjj.exe3rrllll.exefxrrlrl.exedpddv.exerllffff.exebttntt.exejvjdp.exelxfxxxx.exevpddv.exexxfxxxx.exerlxxrrl.exehbbttn.exeffxrrrr.exenbnnhn.exeddvpd.exelxrlrrr.exehhbbnn.exe3jpjv.exe7llfffx.exetnbbbb.exevpppp.exelfxrllf.exevdjdd.exe1lrrlll.exellllflf.exennhbnn.exevpppd.exexlxxrxr.exefxfffff.exe5hnttt.exedpddv.exejjppp.exeffrlfxr.exennbbbn.exejpdvp.exe1dpdp.exexrffflf.exehbhbbn.exenhnhhn.exepjjjd.exe3rfxflf.exexlrxrrr.exebhhttt.exedvppd.exelrrxxfl.exe7xllffr.exebnhbnb.exeddddp.exe7fxxrrl.exe3xfxxxx.exebtbtnn.exeddjjj.exefrrlfff.exenhbbhn.exe1bbttt.exevjpjd.exe7xfxfll.exefxxxrrl.exepid process 2956 9llrfrl.exe 3000 vjjjj.exe 4768 rrrrlll.exe 3916 htbtnn.exe 1728 fxfxllf.exe 2132 btbttt.exe 4780 pppjj.exe 2840 3rrllll.exe 1460 fxrrlrl.exe 4976 dpddv.exe 3584 rllffff.exe 4696 bttntt.exe 388 jvjdp.exe 3216 lxfxxxx.exe 1228 vpddv.exe 2496 xxfxxxx.exe 752 rlxxrrl.exe 4792 hbbttn.exe 1512 ffxrrrr.exe 2492 nbnnhn.exe 2400 ddvpd.exe 4952 lxrlrrr.exe 3592 hhbbnn.exe 4752 3jpjv.exe 5056 7llfffx.exe 1408 tnbbbb.exe 1996 vpppp.exe 4144 lfxrllf.exe 3580 vdjdd.exe 216 1lrrlll.exe 2196 llllflf.exe 2268 nnhbnn.exe 3012 vpppd.exe 4368 xlxxrxr.exe 4576 fxfffff.exe 4136 5hnttt.exe 4908 dpddv.exe 2140 jjppp.exe 5044 ffrlfxr.exe 3916 nnbbbn.exe 1300 jpdvp.exe 2172 1dpdp.exe 3252 xrffflf.exe 4828 hbhbbn.exe 3468 nhnhhn.exe 1192 pjjjd.exe 1832 3rfxflf.exe 3308 xlrxrrr.exe 4976 bhhttt.exe 1196 dvppd.exe 2152 lrrxxfl.exe 4692 7xllffr.exe 4904 bnhbnb.exe 872 ddddp.exe 2432 7fxxrrl.exe 4448 3xfxxxx.exe 1052 btbtnn.exe 4404 ddjjj.exe 2884 frrlfff.exe 4776 nhbbhn.exe 508 1bbttt.exe 876 vjpjd.exe 4116 7xfxfll.exe 2324 fxxxrrl.exe -
Processes:
resource yara_rule behavioral2/memory/1836-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe9llrfrl.exevjjjj.exerrrrlll.exehtbtnn.exefxfxllf.exebtbttt.exepppjj.exe3rrllll.exefxrrlrl.exedpddv.exerllffff.exebttntt.exejvjdp.exelxfxxxx.exevpddv.exexxfxxxx.exerlxxrrl.exehbbttn.exeffxrrrr.exenbnnhn.exeddvpd.exedescription pid process target process PID 1836 wrote to memory of 2956 1836 94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe 9llrfrl.exe PID 1836 wrote to memory of 2956 1836 94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe 9llrfrl.exe PID 1836 wrote to memory of 2956 1836 94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe 9llrfrl.exe PID 2956 wrote to memory of 3000 2956 9llrfrl.exe vjjjj.exe PID 2956 wrote to memory of 3000 2956 9llrfrl.exe vjjjj.exe PID 2956 wrote to memory of 3000 2956 9llrfrl.exe vjjjj.exe PID 3000 wrote to memory of 4768 3000 vjjjj.exe rrrrlll.exe PID 3000 wrote to memory of 4768 3000 vjjjj.exe rrrrlll.exe PID 3000 wrote to memory of 4768 3000 vjjjj.exe rrrrlll.exe PID 4768 wrote to memory of 3916 4768 rrrrlll.exe htbtnn.exe PID 4768 wrote to memory of 3916 4768 rrrrlll.exe htbtnn.exe PID 4768 wrote to memory of 3916 4768 rrrrlll.exe htbtnn.exe PID 3916 wrote to memory of 1728 3916 htbtnn.exe fxfxllf.exe PID 3916 wrote to memory of 1728 3916 htbtnn.exe fxfxllf.exe PID 3916 wrote to memory of 1728 3916 htbtnn.exe fxfxllf.exe PID 1728 wrote to memory of 2132 1728 fxfxllf.exe btbttt.exe PID 1728 wrote to memory of 2132 1728 fxfxllf.exe btbttt.exe PID 1728 wrote to memory of 2132 1728 fxfxllf.exe btbttt.exe PID 2132 wrote to memory of 4780 2132 btbttt.exe pppjj.exe PID 2132 wrote to memory of 4780 2132 btbttt.exe pppjj.exe PID 2132 wrote to memory of 4780 2132 btbttt.exe pppjj.exe PID 4780 wrote to memory of 2840 4780 pppjj.exe 3rrllll.exe PID 4780 wrote to memory of 2840 4780 pppjj.exe 3rrllll.exe PID 4780 wrote to memory of 2840 4780 pppjj.exe 3rrllll.exe PID 2840 wrote to memory of 1460 2840 3rrllll.exe fxrrlrl.exe PID 2840 wrote to memory of 1460 2840 3rrllll.exe fxrrlrl.exe PID 2840 wrote to memory of 1460 2840 3rrllll.exe fxrrlrl.exe PID 1460 wrote to memory of 4976 1460 fxrrlrl.exe dpddv.exe PID 1460 wrote to memory of 4976 1460 fxrrlrl.exe dpddv.exe PID 1460 wrote to memory of 4976 1460 fxrrlrl.exe dpddv.exe PID 4976 wrote to memory of 3584 4976 dpddv.exe rllffff.exe PID 4976 wrote to memory of 3584 4976 dpddv.exe rllffff.exe PID 4976 wrote to memory of 3584 4976 dpddv.exe rllffff.exe PID 3584 wrote to memory of 4696 3584 rllffff.exe bttntt.exe PID 3584 wrote to memory of 4696 3584 rllffff.exe bttntt.exe PID 3584 wrote to memory of 4696 3584 rllffff.exe bttntt.exe PID 4696 wrote to memory of 388 4696 bttntt.exe jvjdp.exe PID 4696 wrote to memory of 388 4696 bttntt.exe jvjdp.exe PID 4696 wrote to memory of 388 4696 bttntt.exe jvjdp.exe PID 388 wrote to memory of 3216 388 jvjdp.exe lxfxxxx.exe PID 388 wrote to memory of 3216 388 jvjdp.exe lxfxxxx.exe PID 388 wrote to memory of 3216 388 jvjdp.exe lxfxxxx.exe PID 3216 wrote to memory of 1228 3216 lxfxxxx.exe vpddv.exe PID 3216 wrote to memory of 1228 3216 lxfxxxx.exe vpddv.exe PID 3216 wrote to memory of 1228 3216 lxfxxxx.exe vpddv.exe PID 1228 wrote to memory of 2496 1228 vpddv.exe xxfxxxx.exe PID 1228 wrote to memory of 2496 1228 vpddv.exe xxfxxxx.exe PID 1228 wrote to memory of 2496 1228 vpddv.exe xxfxxxx.exe PID 2496 wrote to memory of 752 2496 xxfxxxx.exe rlxxrrl.exe PID 2496 wrote to memory of 752 2496 xxfxxxx.exe rlxxrrl.exe PID 2496 wrote to memory of 752 2496 xxfxxxx.exe rlxxrrl.exe PID 752 wrote to memory of 4792 752 rlxxrrl.exe hbbttn.exe PID 752 wrote to memory of 4792 752 rlxxrrl.exe hbbttn.exe PID 752 wrote to memory of 4792 752 rlxxrrl.exe hbbttn.exe PID 4792 wrote to memory of 1512 4792 hbbttn.exe ffxrrrr.exe PID 4792 wrote to memory of 1512 4792 hbbttn.exe ffxrrrr.exe PID 4792 wrote to memory of 1512 4792 hbbttn.exe ffxrrrr.exe PID 1512 wrote to memory of 2492 1512 ffxrrrr.exe nbnnhn.exe PID 1512 wrote to memory of 2492 1512 ffxrrrr.exe nbnnhn.exe PID 1512 wrote to memory of 2492 1512 ffxrrrr.exe nbnnhn.exe PID 2492 wrote to memory of 2400 2492 nbnnhn.exe ddvpd.exe PID 2492 wrote to memory of 2400 2492 nbnnhn.exe ddvpd.exe PID 2492 wrote to memory of 2400 2492 nbnnhn.exe ddvpd.exe PID 2400 wrote to memory of 4952 2400 ddvpd.exe lxrlrrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\94bd7e6fde6f46a398f0daa563f7d010_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\9llrfrl.exec:\9llrfrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\vjjjj.exec:\vjjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\rrrrlll.exec:\rrrrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\htbtnn.exec:\htbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\fxfxllf.exec:\fxfxllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\btbttt.exec:\btbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\pppjj.exec:\pppjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\3rrllll.exec:\3rrllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\fxrrlrl.exec:\fxrrlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\dpddv.exec:\dpddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\rllffff.exec:\rllffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\bttntt.exec:\bttntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\jvjdp.exec:\jvjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\vpddv.exec:\vpddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\rlxxrrl.exec:\rlxxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\hbbttn.exec:\hbbttn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\ffxrrrr.exec:\ffxrrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\nbnnhn.exec:\nbnnhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\ddvpd.exec:\ddvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\lxrlrrr.exec:\lxrlrrr.exe23⤵
- Executes dropped EXE
PID:4952 -
\??\c:\hhbbnn.exec:\hhbbnn.exe24⤵
- Executes dropped EXE
PID:3592 -
\??\c:\3jpjv.exec:\3jpjv.exe25⤵
- Executes dropped EXE
PID:4752 -
\??\c:\7llfffx.exec:\7llfffx.exe26⤵
- Executes dropped EXE
PID:5056 -
\??\c:\tnbbbb.exec:\tnbbbb.exe27⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vpppp.exec:\vpppp.exe28⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lfxrllf.exec:\lfxrllf.exe29⤵
- Executes dropped EXE
PID:4144 -
\??\c:\vdjdd.exec:\vdjdd.exe30⤵
- Executes dropped EXE
PID:3580 -
\??\c:\1lrrlll.exec:\1lrrlll.exe31⤵
- Executes dropped EXE
PID:216 -
\??\c:\llllflf.exec:\llllflf.exe32⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nnhbnn.exec:\nnhbnn.exe33⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vpppd.exec:\vpppd.exe34⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xlxxrxr.exec:\xlxxrxr.exe35⤵
- Executes dropped EXE
PID:4368 -
\??\c:\fxfffff.exec:\fxfffff.exe36⤵
- Executes dropped EXE
PID:4576 -
\??\c:\5hnttt.exec:\5hnttt.exe37⤵
- Executes dropped EXE
PID:4136 -
\??\c:\dpddv.exec:\dpddv.exe38⤵
- Executes dropped EXE
PID:4908 -
\??\c:\jjppp.exec:\jjppp.exe39⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ffrlfxr.exec:\ffrlfxr.exe40⤵
- Executes dropped EXE
PID:5044 -
\??\c:\nnbbbn.exec:\nnbbbn.exe41⤵
- Executes dropped EXE
PID:3916 -
\??\c:\jpdvp.exec:\jpdvp.exe42⤵
- Executes dropped EXE
PID:1300 -
\??\c:\1dpdp.exec:\1dpdp.exe43⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xrffflf.exec:\xrffflf.exe44⤵
- Executes dropped EXE
PID:3252 -
\??\c:\hbhbbn.exec:\hbhbbn.exe45⤵
- Executes dropped EXE
PID:4828 -
\??\c:\nhnhhn.exec:\nhnhhn.exe46⤵
- Executes dropped EXE
PID:3468 -
\??\c:\pjjjd.exec:\pjjjd.exe47⤵
- Executes dropped EXE
PID:1192 -
\??\c:\3rfxflf.exec:\3rfxflf.exe48⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xlrxrrr.exec:\xlrxrrr.exe49⤵
- Executes dropped EXE
PID:3308 -
\??\c:\bhhttt.exec:\bhhttt.exe50⤵
- Executes dropped EXE
PID:4976 -
\??\c:\dvppd.exec:\dvppd.exe51⤵
- Executes dropped EXE
PID:1196 -
\??\c:\lrrxxfl.exec:\lrrxxfl.exe52⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7xllffr.exec:\7xllffr.exe53⤵
- Executes dropped EXE
PID:4692 -
\??\c:\bnhbnb.exec:\bnhbnb.exe54⤵
- Executes dropped EXE
PID:4904 -
\??\c:\ddddp.exec:\ddddp.exe55⤵
- Executes dropped EXE
PID:872 -
\??\c:\7fxxrrl.exec:\7fxxrrl.exe56⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3xfxxxx.exec:\3xfxxxx.exe57⤵
- Executes dropped EXE
PID:4448 -
\??\c:\btbtnn.exec:\btbtnn.exe58⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ddjjj.exec:\ddjjj.exe59⤵
- Executes dropped EXE
PID:4404 -
\??\c:\frrlfff.exec:\frrlfff.exe60⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nhbbhn.exec:\nhbbhn.exe61⤵
- Executes dropped EXE
PID:4776 -
\??\c:\1bbttt.exec:\1bbttt.exe62⤵
- Executes dropped EXE
PID:508 -
\??\c:\vjpjd.exec:\vjpjd.exe63⤵
- Executes dropped EXE
PID:876 -
\??\c:\7xfxfll.exec:\7xfxfll.exe64⤵
- Executes dropped EXE
PID:4116 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe65⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hnbtnn.exec:\hnbtnn.exe66⤵PID:4636
-
\??\c:\nntthn.exec:\nntthn.exe67⤵PID:2440
-
\??\c:\vpppd.exec:\vpppd.exe68⤵PID:4016
-
\??\c:\7vddv.exec:\7vddv.exe69⤵PID:3232
-
\??\c:\flrllll.exec:\flrllll.exe70⤵PID:2292
-
\??\c:\lflfffx.exec:\lflfffx.exe71⤵PID:2988
-
\??\c:\nnhhbb.exec:\nnhhbb.exe72⤵PID:5048
-
\??\c:\3djdd.exec:\3djdd.exe73⤵PID:4496
-
\??\c:\pjvpj.exec:\pjvpj.exe74⤵PID:3676
-
\??\c:\xflxrrl.exec:\xflxrrl.exe75⤵PID:3344
-
\??\c:\hbhbhh.exec:\hbhbhh.exe76⤵PID:3140
-
\??\c:\hbhhth.exec:\hbhhth.exe77⤵PID:4816
-
\??\c:\djvpj.exec:\djvpj.exe78⤵PID:2672
-
\??\c:\jjvpp.exec:\jjvpp.exe79⤵PID:2336
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe80⤵PID:4368
-
\??\c:\lfflflf.exec:\lfflflf.exe81⤵PID:4984
-
\??\c:\nhtttb.exec:\nhtttb.exe82⤵PID:2956
-
\??\c:\ttnnnh.exec:\ttnnnh.exe83⤵PID:3904
-
\??\c:\jdjjd.exec:\jdjjd.exe84⤵PID:1524
-
\??\c:\1xfxlrx.exec:\1xfxlrx.exe85⤵PID:2820
-
\??\c:\7ffrlrr.exec:\7ffrlrr.exe86⤵PID:3220
-
\??\c:\1hhbbt.exec:\1hhbbt.exe87⤵PID:1004
-
\??\c:\pjdvv.exec:\pjdvv.exe88⤵PID:4812
-
\??\c:\1ffxflf.exec:\1ffxflf.exe89⤵PID:384
-
\??\c:\bhbbbt.exec:\bhbbbt.exe90⤵PID:3940
-
\??\c:\jvjvv.exec:\jvjvv.exe91⤵PID:3460
-
\??\c:\ppvpp.exec:\ppvpp.exe92⤵PID:3988
-
\??\c:\thttnn.exec:\thttnn.exe93⤵PID:2964
-
\??\c:\5nttnn.exec:\5nttnn.exe94⤵PID:4512
-
\??\c:\jdjpp.exec:\jdjpp.exe95⤵PID:1196
-
\??\c:\7lrlfff.exec:\7lrlfff.exe96⤵PID:1744
-
\??\c:\3rxxxrx.exec:\3rxxxrx.exe97⤵PID:5096
-
\??\c:\hbtttt.exec:\hbtttt.exe98⤵PID:3480
-
\??\c:\dvjjd.exec:\dvjjd.exe99⤵PID:4896
-
\??\c:\jjvpp.exec:\jjvpp.exe100⤵PID:2008
-
\??\c:\xrfxrll.exec:\xrfxrll.exe101⤵PID:2812
-
\??\c:\tbbbbt.exec:\tbbbbt.exe102⤵PID:4264
-
\??\c:\hnttnn.exec:\hnttnn.exe103⤵PID:4192
-
\??\c:\dddvp.exec:\dddvp.exe104⤵PID:1312
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe105⤵PID:508
-
\??\c:\bbtttt.exec:\bbtttt.exe106⤵PID:424
-
\??\c:\dvdjj.exec:\dvdjj.exe107⤵PID:1564
-
\??\c:\xrxlfxx.exec:\xrxlfxx.exe108⤵PID:3680
-
\??\c:\lxxxrxx.exec:\lxxxrxx.exe109⤵PID:1256
-
\??\c:\hbbttt.exec:\hbbttt.exe110⤵PID:3708
-
\??\c:\bbbtbb.exec:\bbbtbb.exe111⤵PID:4428
-
\??\c:\dddvj.exec:\dddvj.exe112⤵PID:528
-
\??\c:\7vddp.exec:\7vddp.exe113⤵PID:4708
-
\??\c:\lrxxllr.exec:\lrxxllr.exe114⤵PID:3336
-
\??\c:\tbhhbh.exec:\tbhhbh.exe115⤵PID:1612
-
\??\c:\thbtnn.exec:\thbtnn.exe116⤵PID:5088
-
\??\c:\ddvvp.exec:\ddvvp.exe117⤵PID:2236
-
\??\c:\lrxxrrx.exec:\lrxxrrx.exe118⤵PID:2120
-
\??\c:\bbhttt.exec:\bbhttt.exe119⤵PID:4336
-
\??\c:\tntttt.exec:\tntttt.exe120⤵PID:400
-
\??\c:\jjjjv.exec:\jjjjv.exe121⤵PID:3812
-
\??\c:\dvvpj.exec:\dvvpj.exe122⤵PID:1836
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe123⤵PID:4136
-
\??\c:\xrffxxr.exec:\xrffxxr.exe124⤵PID:588
-
\??\c:\bhbttb.exec:\bhbttb.exe125⤵PID:3756
-
\??\c:\bhhbtt.exec:\bhhbtt.exe126⤵PID:3220
-
\??\c:\vjvpd.exec:\vjvpd.exe127⤵PID:1004
-
\??\c:\5djjp.exec:\5djjp.exe128⤵PID:1328
-
\??\c:\rfllfll.exec:\rfllfll.exe129⤵PID:2328
-
\??\c:\hhhhhh.exec:\hhhhhh.exe130⤵PID:1164
-
\??\c:\tnhbtn.exec:\tnhbtn.exe131⤵PID:2580
-
\??\c:\vvvjd.exec:\vvvjd.exe132⤵PID:2916
-
\??\c:\dvppd.exec:\dvppd.exe133⤵PID:3864
-
\??\c:\3lrxflf.exec:\3lrxflf.exe134⤵PID:2600
-
\??\c:\lfxrllf.exec:\lfxrllf.exe135⤵PID:5096
-
\??\c:\nnttnt.exec:\nnttnt.exe136⤵PID:3744
-
\??\c:\hbbbnh.exec:\hbbbnh.exe137⤵PID:1628
-
\??\c:\jvvvj.exec:\jvvvj.exe138⤵PID:2812
-
\??\c:\htbttt.exec:\htbttt.exe139⤵PID:4264
-
\??\c:\ddpjd.exec:\ddpjd.exe140⤵PID:4192
-
\??\c:\pjjjj.exec:\pjjjj.exe141⤵PID:1312
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe142⤵PID:508
-
\??\c:\3ppjd.exec:\3ppjd.exe143⤵PID:424
-
\??\c:\ffrrlrr.exec:\ffrrlrr.exe144⤵PID:2400
-
\??\c:\tnnnhh.exec:\tnnnhh.exe145⤵PID:3244
-
\??\c:\pvjdv.exec:\pvjdv.exe146⤵PID:4504
-
\??\c:\lflrrrr.exec:\lflrrrr.exe147⤵PID:2644
-
\??\c:\bbnnnt.exec:\bbnnnt.exe148⤵PID:1268
-
\??\c:\djvpj.exec:\djvpj.exe149⤵PID:2656
-
\??\c:\pvjjj.exec:\pvjjj.exe150⤵PID:4012
-
\??\c:\ffllffr.exec:\ffllffr.exe151⤵PID:4212
-
\??\c:\rxflfff.exec:\rxflfff.exe152⤵PID:1560
-
\??\c:\nbttnn.exec:\nbttnn.exe153⤵PID:3076
-
\??\c:\dddvp.exec:\dddvp.exe154⤵PID:3140
-
\??\c:\3pjvp.exec:\3pjvp.exe155⤵PID:4816
-
\??\c:\llfllrr.exec:\llfllrr.exe156⤵PID:4336
-
\??\c:\xlrrrxr.exec:\xlrrrxr.exe157⤵PID:400
-
\??\c:\tbtnnb.exec:\tbtnnb.exe158⤵PID:4576
-
\??\c:\pdvjp.exec:\pdvjp.exe159⤵PID:4768
-
\??\c:\jjvvp.exec:\jjvvp.exe160⤵PID:4268
-
\??\c:\xxllfll.exec:\xxllfll.exe161⤵PID:2616
-
\??\c:\nhbbtb.exec:\nhbbtb.exe162⤵PID:4596
-
\??\c:\dvjpj.exec:\dvjpj.exe163⤵PID:5076
-
\??\c:\jvdvp.exec:\jvdvp.exe164⤵PID:2628
-
\??\c:\5rrlfll.exec:\5rrlfll.exe165⤵PID:1028
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe166⤵PID:452
-
\??\c:\hbhbnn.exec:\hbhbnn.exe167⤵PID:3800
-
\??\c:\hbnbnn.exec:\hbnbnn.exe168⤵PID:2968
-
\??\c:\dpdpj.exec:\dpdpj.exe169⤵PID:5072
-
\??\c:\fflfllr.exec:\fflfllr.exe170⤵PID:5096
-
\??\c:\3lfxrlf.exec:\3lfxrlf.exe171⤵PID:4176
-
\??\c:\tbhbtt.exec:\tbhbtt.exe172⤵PID:4720
-
\??\c:\hhbnbh.exec:\hhbnbh.exe173⤵PID:4792
-
\??\c:\jjjjv.exec:\jjjjv.exe174⤵PID:4968
-
\??\c:\vvppv.exec:\vvppv.exe175⤵PID:2492
-
\??\c:\3rxrfff.exec:\3rxrfff.exe176⤵PID:1312
-
\??\c:\tnbnnt.exec:\tnbnnt.exe177⤵PID:2324
-
\??\c:\btnbbh.exec:\btnbbh.exe178⤵PID:4636
-
\??\c:\dddpp.exec:\dddpp.exe179⤵PID:2400
-
\??\c:\7jjdd.exec:\7jjdd.exe180⤵PID:4080
-
\??\c:\nhnnnn.exec:\nhnnnn.exe181⤵PID:4504
-
\??\c:\tttnnt.exec:\tttnnt.exe182⤵PID:2644
-
\??\c:\ppjvj.exec:\ppjvj.exe183⤵PID:3912
-
\??\c:\vjjvv.exec:\vjjvv.exe184⤵PID:3104
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe185⤵PID:5088
-
\??\c:\nbnhbb.exec:\nbnhbb.exe186⤵PID:2556
-
\??\c:\btbtnn.exec:\btbtnn.exe187⤵PID:4324
-
\??\c:\pjdpv.exec:\pjdpv.exe188⤵PID:2120
-
\??\c:\jjdpd.exec:\jjdpd.exe189⤵PID:4372
-
\??\c:\9ffxxxr.exec:\9ffxxxr.exe190⤵PID:776
-
\??\c:\tthbtt.exec:\tthbtt.exe191⤵PID:4984
-
\??\c:\jvdpd.exec:\jvdpd.exe192⤵PID:2848
-
\??\c:\vpppj.exec:\vpppj.exe193⤵PID:4488
-
\??\c:\1rxrllf.exec:\1rxrllf.exe194⤵PID:3704
-
\??\c:\hbbttb.exec:\hbbttb.exe195⤵PID:1648
-
\??\c:\jjjdv.exec:\jjjdv.exe196⤵PID:1636
-
\??\c:\rxlfxrl.exec:\rxlfxrl.exe197⤵PID:5076
-
\??\c:\fffxxxr.exec:\fffxxxr.exe198⤵PID:2628
-
\??\c:\9ttttt.exec:\9ttttt.exe199⤵PID:4696
-
\??\c:\pjjvj.exec:\pjjvj.exe200⤵PID:388
-
\??\c:\rxrrffx.exec:\rxrrffx.exe201⤵PID:4500
-
\??\c:\7lfxllf.exec:\7lfxllf.exe202⤵PID:524
-
\??\c:\nnbbtt.exec:\nnbbtt.exe203⤵PID:2008
-
\??\c:\3vjdj.exec:\3vjdj.exe204⤵PID:5096
-
\??\c:\vvvpj.exec:\vvvpj.exe205⤵PID:5016
-
\??\c:\frrlfxx.exec:\frrlfxx.exe206⤵PID:4720
-
\??\c:\tbnnnb.exec:\tbnnnb.exe207⤵PID:988
-
\??\c:\nbhbtn.exec:\nbhbtn.exe208⤵PID:5012
-
\??\c:\vppjj.exec:\vppjj.exe209⤵PID:1464
-
\??\c:\pjpjd.exec:\pjpjd.exe210⤵PID:4092
-
\??\c:\xrrlllf.exec:\xrrlllf.exe211⤵PID:2324
-
\??\c:\nhnnnb.exec:\nhnnnb.exe212⤵PID:2068
-
\??\c:\3dpvj.exec:\3dpvj.exe213⤵PID:2124
-
\??\c:\ddjdv.exec:\ddjdv.exe214⤵PID:3232
-
\??\c:\lxxrfxf.exec:\lxxrfxf.exe215⤵PID:544
-
\??\c:\btbtnh.exec:\btbtnh.exe216⤵PID:3692
-
\??\c:\1pvpv.exec:\1pvpv.exe217⤵PID:4932
-
\??\c:\pddpj.exec:\pddpj.exe218⤵PID:1472
-
\??\c:\ffxxlfx.exec:\ffxxlfx.exe219⤵PID:4764
-
\??\c:\lxrfxxr.exec:\lxrfxxr.exe220⤵PID:4484
-
\??\c:\bbttnh.exec:\bbttnh.exe221⤵PID:2692
-
\??\c:\dvdvp.exec:\dvdvp.exe222⤵PID:2904
-
\??\c:\ffxrrfx.exec:\ffxrrfx.exe223⤵PID:4988
-
\??\c:\rlllfff.exec:\rlllfff.exe224⤵PID:4836
-
\??\c:\ppddd.exec:\ppddd.exe225⤵PID:2312
-
\??\c:\5djdd.exec:\5djdd.exe226⤵PID:2304
-
\??\c:\frrrrrr.exec:\frrrrrr.exe227⤵PID:3756
-
\??\c:\xxxrfff.exec:\xxxrfff.exe228⤵PID:1640
-
\??\c:\bbhhhh.exec:\bbhhhh.exe229⤵PID:4600
-
\??\c:\jvdvv.exec:\jvdvv.exe230⤵PID:4624
-
\??\c:\pjpvj.exec:\pjpvj.exe231⤵PID:4536
-
\??\c:\xfrrllf.exec:\xfrrllf.exe232⤵PID:3864
-
\??\c:\flrflxr.exec:\flrflxr.exe233⤵PID:4548
-
\??\c:\bnhhbt.exec:\bnhhbt.exe234⤵PID:2968
-
\??\c:\dvvpj.exec:\dvvpj.exe235⤵PID:4896
-
\??\c:\5fllllf.exec:\5fllllf.exe236⤵PID:1220
-
\??\c:\frxrffl.exec:\frxrffl.exe237⤵PID:3196
-
\??\c:\nnnhbb.exec:\nnnhbb.exe238⤵PID:4748
-
\??\c:\djpjv.exec:\djpjv.exe239⤵PID:3496
-
\??\c:\pdjjj.exec:\pdjjj.exe240⤵PID:1696
-
\??\c:\frrfrrl.exec:\frrfrrl.exe241⤵PID:5012
-
\??\c:\flfxrxx.exec:\flfxrxx.exe242⤵PID:2084